CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
What the vulnerability does
The Ninja Countdown | Fastest Countdown Builder plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the 'ninja_countdown_admin_ajax' AJAX endpoint in all versions up to, and including, 1.5.0. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete arbitrary countdowns.
Explanation of Vulnerability in Simple Terms
Ninja Countdown | Fastest Countdown Builder versions 1.5.0 and earlier lack proper authorization checks, allowing authenticated users to modify countdown data they should not have access to. An attacker with a low-privilege account can alter countdowns belonging to other users or the site. Update to a version newer than 1.5.0 to resolve this issue.
What an attacker can do
Modify countdown timers and settings belonging to other users or the site.
Potential impact on your site
Countdowns can be altered or defaced by any authenticated user, disrupting site content and user experience.
Conditions required to exploit
Attacker must have a low-privilege user account on the site.
Key dates
External resources
